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CLAIMS 



1 . A method for the multi-exponentiation {11^=^1^ gf') or the multi-scalar 
multiplication (S^=i^ eigi) of elements (gi) by means of in each case at least one exponent or 
scalar (ei)^ in particular an integer exponent or scalar, wliich has in each case a maximum bit 
rate (n) or bit length, in particular for the exponentiation (g^) or scalar multiplication (e g) of 
an element (g) by means of at least one exponent or scalar (e), in particular an integer 
exponent or scalar, which has in each case a maximum bit rate (n) or bit length, which 
elements (g/; g) derive from at least one group (G), for example an Abelian group, which 

in the case of (multi-)exponentiation is notated in particular multiplicatively 
and 

in the case of (multi-)scalar multiplication is notated in particular additively, 
characterized by the following method steps: 
[a. 1] computing and storing or 

[a. 2] retrieving from at least one memory 

ail powers (gi^) or all multiples (cgi), wherein c is a permissible positive 

coefficient; 

[b] dividing each exponent or scalar (e,) into a number of chunlcs or into a number 

of parts (e/,^) having a chunk or part width defined by a specific bit rate (L); 
and 

[c] individually recoding the chunks or parts (Cj^jc). 

2. A method as claimed in claim 1 , characterized in that the exponent or scalar 
(ei) is represented in the divided form e/ = S/c-o'^ ^i,k2^^^ wherein 

r is defined as the number of chunks or paits (Ci^k)^ in particular as an integer 
quotient of the maxhnum bit rate (n) and the bit rate (L) of the chunlc or part 
width, and 

0 < et,k < 2^. 



3. 



A method as claimed in claim 1 or 2, characterized in that the chunk or part 

SUBSTITUTE SHEET (RULE 26) 



wo 2005/088440 PCT/IB2005/050614 

23 

width (L) is selected to be 

significantly greater liian a parameter (w) which corresponds to the width, in 
particular to the upper limit of the width, of a window over which the bits of 

the respective exponent or scalar (ei) are read, and 
5 - significantly shorter than the maximum length of each exponent or scalar (e,), 

in particular is selected prior to method step [a.l] and/or [a.2]. 



4. A method as claimed in at least one of claims 1 to 3, characterized in that 

in the case of (multi-)exponentiation, method step [c] of receding the chunks 
10 or parts (ei^jc) can be divided into the following substeps for each individual 

chxank or for each individual part (ei,k) of each exponent (e,): 
[c.l] setting a temporary variable (x) to a standardized value, in particular to the 

value 1 of the element of the group (G) which is neutral with respect to the 

group operation assigned to the group (G); 
15 [c.2] successively setting a variable (k) to the values r-1 , r-2, 0, wherein for each 

value k—rA^ r-l^ 0 of the variable (k) the following substeps are carried 

out: 

[c.2.i] for each value i ~ 1, 2, of an index (z)? wherein d is defined as the number 

of elements (gi), in particular depending on the number of exponents (ei) 
20 assigned to the elements (gi): 

r 

[c.2.i.a] recoding the chunk or part (e/,^) as the sxim (Ey=o bij2!) of powers of two (2/) 

weighted by in each case at least one coefficient (bij) deriving from at least 
one finite set (C) of integers; 
[c.2.i.b] if the coefficient (bi^i) assigned to the highest power of two (2^) does not 

25 vanish: setting the temporary variable (x) to the product of temporary variable 

(x) and the power (gi ''^) of the element (gi) which is assigned to the coefficient 
(pi^i) of the highest power of two (2^); 
[c.2.ii] for each value y = Z-1, L-2, 0 of the index (/): 

[c.2.ii.a] squaring the temporary variable (x); 
30 [c.2.ii.b] for each value i = 1, 2, J of the index (/): 

if the coefficient (biJ) assigned to the power of two (2^) does not vanish: 
setting the temporary variable (x) to the product of temporary variable 
(x) and the power (g/'^) of the element (gi) which is assigned to the 
respective coefficient (b/J) of the power of two (2^); and 
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after method step [c] of individually receding the chunks or parts (et^k) the 
temporary variable (x) is returned. 



5. A method as claimed in at least one of claims 1 to 3, characterized in that 

5 - in the case of (multi-)scalar multiplication, method step [c] of receding the 

chunks or parts (e/,^) can be divided into the following substeps for each 

individual chunk or for each individual part {et^k) of each exponent (e,): 
[c.l] setting a temporary variable {x) to a standardized value, in particulai- to the 

value 0 of the element of the group {G) which is neutral with respect to the 
10 group operation assigned to the group (G); 

[c.2] successively setting a variable (k) to the values r-l, r-l^ ...5 0, wherein for each 

value k^r-l, r-l^ 0 of the variable (it) the following substeps are carried 

out: 

[c.2.i] for each value / = 1, 2, ^ of an index (/), wherein d is defined as the nimiber 

15 of elements (gi)^ in particular depending on the number of scalars (e,) assigned 

to the elements (g,): 

[c.2.i.a] receding the chunk or part (e/,^) as the sum (Lj^o bij2!) of powers of two Q!) 

weighted by in each case at least one coefficient (bij) deriving from at least 
one finite set (C) of integers; 
20 [c.2.i.b] if the coefficient assigned to the highest power of two (2^) does not 

vanish: setting the temporary variable (x) to the sum of temporary variable (x) 
and the multiple (biXgi) of the element (g,) which is assigned to the coefficient 
of the highest power of two (2^); 
[c.2.ii] for each value j = Z-1, Z-2, 0 of the index (/): 

25 [c.2.ii.a] doubling the temporary variable (x); 

[c.2ii.b] for each value z = 1,2, d of the index {i): 

if the coefficient {bij) assigned to the power of two (2") does not vanish: 
setting the temporary variable (x) to the sum of temporary variable (x) 
and the multiple (biXgi) of the element (g/) which is assigned to the 
30 coefficient (biJ) of the power of two and 

after method step [c] of individually receding the chunks or parts {ei^k) the 
temporary variable (x) is returned. 



6. A method as claimed in at least one of claims 1 to 5, characterized in that 
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the receded chunk or the receded part is used once and 

the memory unit in which the recoded chunk or the recoded part (e/^^t) is stored 

is used to recode the following chunk or the following part (e/.^.;). 

7. A method as claimed in at least one of claims 1 to 6, characterized in that the 
method is implemented on at least one microprocessor assigned in particular to at least one 
chip card and/or in particular to at least one smart card. 

8. A microprocessor which operates in accordance with a method as claimed in at 
least one of claims 1 to 7. 

9. A device, in particular a chip card and/or in particular a smart card, having at 
least one microprocessor as claimed in claim 8. 

10. The use of a method as claimed in at least one of claims 1 to 7 and/or of at 
least one microprocessor as claimed in claim 8 and/or of at least one device, in particular of at 
least one chip card and/or in particular of at least one smart card, as claimed in claim 9, in at 
least one cryptosystem, in particular in at least one public key cryptosystem, in at least one 
key exchange system or in at least one signature system. 
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